skysight-inc/HackerNews huggingface dataset:
This is MimeCast, one of the larger European corporate email filtering and security systems, saying:

> "Our investigation also showed that the threat actor accessed, and potentially exfiltrated, certain encrypted service account credentials created by customers hosted in the United States and the United Kingdom. These credentials establish connections from Mimecast tenants to on-premise and cloud services, which include LDAP, Azure Active Directory, Exchange Web Services, POP3 journaling, and SMTP-authenticated delivery routes."

> "Although we are not aware that any of the encrypted credentials have been decrypted or misused, we are advising customers hosted in the United States and United Kingdom to take precautionary steps to reset their credentials."

and

> "Our investigation has now confirmed that this incident is related to the SolarWinds Orion software compromise and was perpetrated by the same sophisticated threat actor."

Two weeks ago ( https://news.ycombinator.com/item?id=25751928 ) the linked write-up in Ars Technica wrote "It’s way too early to say that the Mimecast event is connected to the SolarWinds hack campaign, but there’s no denying that some of the circumstances match.", now it is confirmed.

(Unhelpful title, but HN rules say to use it verbatim)
Certainly, that is literally the point of equity research departments (not that they do particularly well at it).
31 CVEs later I think it's safe to say that this particular author does not possess superhuman standards. How much more evidence would we need?
And what percent of those are real humans?
The standard brand name combination pills come to nearly $20,000 a year for the public insurers in Canada. They really do pay that much.
Sign-in cookies are always first party. That's completely out of context here where we're taking about tracking cookies.
I wonder if datacenter covid restrictions had an impact?

Less movement, less vibration, less breathing, datacenter doors staying closed longer, generally less planned maintenance, etc etc.
I'm curious, will he answered given his vested interest in "exabyte-scale analytical database" ? :-)

And laurenz_albe has a vested interest in PG as he's a contributor.

So I, too, would love more concrete details.
I was "stuck" working with a bunch of leading academics and researchers on a SemWeb project using OWL/RDF, in collaboration with DARPA and the US Department of Defense, around 2008-2009.

You are absolutely correct that they are hostile to anything outside of their "ideology".

The awful, horrific performance of the RDF/OWL databases compared to the impure, heretical evil Neo4j that they despised for its practicality..... that was always funny.

Another interesting thing I encountered in the field was the side-effect of an academic field that sounds really good to people who have never built anything EVER is that it can often get a ton of funding and grant money from central government organizations, thereby creating legions of rather shitty companies (especially in the EU, where the grants were everywhere) that have the word "semantic" in the name even though they do nothing with actual semantic technology. These shitty companies are often just there to employ the academics.

The craziest thing was these projects where they would employ a dozen or so "library scientists" who were all just masters and phd students who had, for some reason, decided to study to be librarians in the digital era to create the OWL ontologies. None of them knew anything about computer science or programming, and they would just sit there and read thousands of policy documents and use an Eclipse based GUI to create and edit giant graphs of knowledge and rules. All were being paid six figures, and didn't produce a single goddammed thing of value. So much taxpayer money in those rooms going to complete waste. Glad it wasn't just me that thought the community was a joke.

The semantic web will arrive one day, but OWL and SPARQL won't be anywhere in it. And it won't be any of these academics delivering it.
NoScript; My browser only runs trusted code on my system. And if you are running an updated browser without NoScript or some equivalent, that's very dangerous.
Reported the channel to youtube.

Let's see what they say.
Where Joe Biden's moon rock came from
Thanks for sharing this link, I had been looking for something like this!
> Facebook was successful because 'everyone' was on Facebook.

I am not convinced that Facebook became successful because it was open to everyone. Arguably, FB owes its success precisely to its exclusive status in the early days, and to rising prevalence of affordable devices in the world. It’s difficult to know whether it was successful because it became open, or it happened independently. However, I agree that social networks played a significant role in recent past. (I think that could be fading away, though.)

> Similarly, I've tried migrating from Twitter to Mastodon. But no one I know uses it, so why bother?

> I would pay for Facebook/Twitter, but on the condition that other people are also paying. As soon as people start leaving, there's no much point.

I don’t think it’s worth treating FB/Twitter/Mastodon as some sort of window to the whole of humanity. There are interesting people who do not engage or have no presence on Twitter or Facebook.

Competition is tough when the biggest players radically undercut on price by being free thanks to investor and ad money, riding on network effects of the past. However, users are waking up that by engaging on a free ad-supported service they become the product. The way it’s going, more and more people are using ad-supported free platforms to self-promote, campaign, spread different kinds of evangelism, and/or link to profiles to elsewhere online where higher level of engagement is possible. Where they link to is where new social networks have an opportunity.

---

I think plurality of social networks and a single network for everyone both have their problems.

A plurality of networks presents a challenge in that it’s difficult for one person to engage on many disparate platforms (consumes time and effort), but this can be addressed: for example, with paid networks that don’t need to show ads and can thus offer complete APIs, we just might see fully featured multi-network GUI clients bridging them together.

Having a single network where everyone participates, on the other hand, seems unrealistic—even in a single country. This, I think, can not be addressed at all (except by having a government maintain its own censored avenue for discussion, which is only really compatible with a very authoritarian regime).
The Gigabit Pro support story is very odd. The initial contact goes through the consumer support folks, who are clueless the service even exists. The preferred solution is actually getting on the Comcast Xfinity reddit site to reach a support tech who knows what's going on. After that you're handed off to a Comcast Small Business support agent, who is a real person who maintains contact with you throughout the process (which is a bit involved because it can require permitting, etc.). After that you get a support number that goes to the Metro-E NOC, which is phenomenal. But the billing website still goes through the customer online portal, which doesn't quite understand what's going on.
That would indeed be a huge feat of programming skill! I refer you to the configuration file documentation to treat as a spec: https://www.sudo.ws/man/1.8.3/sudoers.man.html

Implementing a subset of sudo is a weekend project, for some values of useful.
The FDA approves ~40 drugs a year. If you want 40 new drugs a year, it unfortunately will cost somebody something to coordinate the large number of professionals over many years required by a modern development effort. Few drugs have been developed successfully on good intentions.

I find excitement in the fact that we have found a way to get new treatments and cures. Other systems have been tried that weren’t so successful at pumping out new tech.
AstraZeneca: There are a lot of emotions on vaccines in EU. But it's complicated
> Wasn't there an article about paying with your face around here just a bit ago?

There's not much risk to 'pay with your face' for Apple/Google/Samsung pay given it's all on-device biometrics that never leave the phone, but a similar situation is when Google paid $5 to people willing to submit their face to help with facial recognition training in the then-upcoming Pixel 4 phone.

https://gadgets.ndtv.com/mobiles/news/google-pixel-4-usd-5-f...
Pretty much Shell is an European energy company, and due to that they are looking at climate change, and wanting to lead the transition. Mostly because they see that is the way the world is going to go, and they want to be in front and are being pretty open about it. They have been partnering with environmental organisations to increase environmental regulations in the US, and having made early investments, will likely come out ahead of Exxon and others if / when regulations get tightened.
That's the kind of thing I was thinking about. Do they exist?

One example that someone mentioned in a sibling comment is Autosetup, which apparently uses Tcl instead of posix shell + m4. An interesting idea... Tcl is one of those languages that's small enough that it's feasible to include a copy of the interpreter together with the build scripts.
Dopamine Thirst Trap
I'm not sure I understand how this is related to pi-hole.

Your computer sends the raw domain name to pi-hole (e.g. ads.google.com), and pi-hole returns 0.0.0.0 if it's on the block list.

There's nothing Google or anyone can do to make pi-hole stop working.
Could be similar as when the covid lockdowns, mass layoffs and advertisment budget cuts started, I suddenly got bombarded (where it passed the ad blocker) with ads on how to rapidly become a millionaire by investing in stuff from home and similarly sketchy products/services.

I think could really be a risen interest in the gun topic within that demo and/or other companies not targeting them as much currently in the US while other see oportunity to sell more in this moment?
$15 ViralHelmet (DIY, noncommercial), with 99.99% filters
We have put out an open source* design of a $15 to make a "Hoodie Viral Helmet". It's basically a PAPR built from hospital grade filters. If you are interested, go take a look: https://www.viralhelmets.com/15-hoodie-viral-helmet

I run the non-commercial site http://viralhelmets.com.

DETAILS / WHY I'M POSTING

I saw a lot of people pwning the $199 and $300 viral helmets that have come out. (see https://news.ycombinator.com/item?id=25848412) Yeah, at those price points, it doesn't make sense.

The $15 design actually comes out of about 1000+ hours of engineering work (see bunnyPAPR.org). We tried to get interest to commercialize and get certified (NIOSH/FDA). But medical certification in the US is a nightmare and hospitals are slow. We couldn't get much interest or backers.

So, I'm releasing the key parts of our research as a $15 free-to-build plan.

THE FILTERS MATTER
One big difference is that we use hospital-sourced PFT and HMEF filters. We don't trust the supply chains that are pumping out special purpose filters for "fad" mask designs. After the fake/underperforming KN95 scandals in April/May, we stuck with supply chains that existed before COVID. The Stanford pneumask and maskson.org projects took a similar approach.

UPTAKE/ MARKET FIT
We tried approaching some nursing home, school districts, and hospitals about this. They are so inundated by snake oil vendors, they weren't very interested in being a beta tester. Same with CDC... inundated. <shrug>

We do have a few doctors using these, but not publicizing it.

CODA
Viral Helmets could protect all wearers. Could end the pandemic. But, that's a hard sell since they are so "untested". (Though we use PFT and HMEF filters in surgery, and PAPRs in biohazard scenarios... <shrug>)

*Not technically "open source". CC-NC-SA license.

Thanks to @yonran for mentioning ViralHelmets.com in the other yc post.
Please don't post flamewar comments to HN. We've asked you this more than once before and eventually ban accounts that keep doing it. It's not what this site is for.

https://news.ycombinator.com/newsguidelines.html
While it's definitely better than many products they've actually killed completely, abandoning software to the community is often little different from killing it.

Unless someone forks it and starts maintaining it, it will just slowly rot.
I'm struggling to see why you need further research 9 months down the road on such an obvious issue.

Just to put it in perspective, your lowest non-free tier is 50% more expensive than the standard Office365 Business subscription... for which non-dev does this make any kind of sense?

The fact that you then proceed to launch the new prices regardless of having a solution for this obvious issue is to me a really strong indicator that GitLab is not the way to go once we're moving away from the self-hosted JIRA later this year.
Plywood alternates grain patterns at 90° to each other. OSB uses the same technique, but with shredded wood instead of sheets.

Neither use the 3D twisting method outlined in the article.
Nice, although with Google not maintaining it anymore I wonder if there will be enough community interest to spin it off as a real project rather than just an archive.
This sounds overdramatised: caching once for a website you frequent still works just fine, with all the speed benefits on subsequent loads. You're definitely not going to be noticing that the browser now has to build a few more caches than "just the one".
[i] Target: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
[] Status: Retrieval successful
[i] Received 59896 domains

[i] Target: https://mirror1.malwaredomains.com/files/justdomains
[] Status: Not found
[] List download failed: using previously cached list
[i] Received 26854 domains

[i] Target: https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
[] Status: No changes detected
[i] Received 34 domains

[i] Target: https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
[] Status: No changes detected
[i] Received 2701 domains

[i] Target: https://dbl.oisd.nl/
[] Status: Retrieval successful
[i] Received 1167690 domains

[i] Target: https://phishing.army/download/phishing_army_blocklist_extended.txt
[] Status: Retrieval successful
[i] Received 21379 domains

[i] Target: https://raw.githubusercontent.com/deathbybandaid/piholeparser/master/Subscribable-Lists/ParsedBlacklists/AakList.txt
[] Status: Retrieval successful
[i] Received 5 domains

[i] Target: https://raw.githubusercontent.com/deathbybandaid/piholeparser/master/Subscribable-Lists/ParsedBlacklists/Prebake-Obtrusive.txt
[] Status: Retrieval successful
[i] Received 3 domains

[i] Target: https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-blocklist.txt
[] Status: Retrieval successful
[i] Received 14724 domains

[i] Target: https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt
[] Status: Retrieval successful
[i] Received 412 domains

[i] Target: https://raw.githubusercontent.com/hectorm/hmirror/master/data/adaway.org/list.txt
[] Status: Retrieval successful
[i] Received 9182 domains

[i] Target: https://raw.githubusercontent.com/hectorm/hmirror/master/data/disconnect.me-ad/list.txt
[] Status: Retrieval successful
[i] Received 2701 domains

[i] Target: https://raw.githubusercontent.com/notracking/hosts-blocklists/master/hostnames.txt
[] Status: Retrieval successful
[i] Received 209608 domains
A good amount of early Rolling Stones and Beatles records are not in tune, so I’m not either.
The rock carved out a circular chasm some 710 miles across. For the sake of comparison, the asteroid that careened into Earth 66 million years ago and heralded the end of the age of the dinosaurs excavated a pit a mere 110 miles in diameter.

Around 250 million years later, lava poured into this great depression, forming a sea of molten rock named Mare Imbrium, the "Sea of Rains." And as lava lapped at the shores of this magnificent desolation, a curious rock sat nearby: a mangled amalgam of crushed sediment and once-molten matter, a product of the ferocity of that ancient, colossal impact.

For what seemed like an eternity, that rock sat silently on the moon, hit by the occasional micrometeorite. And 3.9 billion years after it was formed, in the twilight days of 1972, two visitors from another world, Apollo 17 astronauts Eugene Cernan and Harrison Schmitt -- Schmitt was the first and only geologist sent to the moon -- saw it glinting in starlight.
Poettering to save the day with systemd-sudo?
US has 'moral imperative' to develop AI weapons, says panel
Yeah, I was astonished that they managed to get such a successful experiment on the first try with trinity, despite 40s technology and computers. I expected that there'd be a few failures before the first successful nuclear explosion.
yesterday's post with discussion and links to previous posts

https://news.ycombinator.com/item?id=25910108
Does anyone else find it ironic Revue official blog is hosted on Medium?

https://blog.getrevue.co
Mother's blood test predicts a sub-type of autism
Nah, that's easy, if you think pineapple should be anywhere around pizza you cannot be my friend
> Todd Miller is a sharp developer and core OpenBSD contributor.

I wonder why OpenBSD wrote their own version. Could it be that, knowing how the sausage is made, they thought it was better to have a salad...?
You could also buy a 10$ bus ticket

https://khn.org/news/americans-cross-border-into-mexico-to-b...
I don't see how that helps you persist a tracking ID.

If you generate a random URL, you'll always get a cache miss.

If you use a static URL, you'll know if you have a new session or not, but that doesn't tell you what the tracking ID was.

The only thing I can imagine is the server serve several images /byte1.png /byte2.png etc. and make them all X by 1 pixels, encoding a random value in the dimensions, assuming that's available to Javascript.

But if you encode the tracking ID in the image somehow, you don't care much whether it was cached or not, it's inherently persistent. It'd mainly be useful if you're trying to reconstruct a super cookie.
> The physics is really pretty simple now.

In general, I’d be wondering how much of what we call physics can actually be factored out as just math, and what we’d be left with.
Well, if you don't have a bunch of pedestrians wandering around outside and people don't generally drive to the store in single-occupant vehicles, you don't really have much need for streetlamps either.

Maybe at some point when the population gets large enough that you'd have imported problems from Earth like random people stealing the Martian equivalent of a CD player and catalytic converter off your rover in the middle of the night, then security lighting may be a thing.

The main use I can think of for outside lighting in the short term would be people doing construction work at night. That might actually be preferred from a radiation point of view; I know Mars doesn't have much protection from radiation, but I'm not sure how much comes directly from the sun versus random ambient radiation in space.

Another possible source of light pollution would be greenhouses with big windows that are lit with artificial light at night.
It makes sense from a $$ and resource usage stand point. I have to assume the best here and believe that the people arguing on there being no merit to CDN hosting of shared libraries all forgetting the two most important things a business must consider.

Every byte sent will cost the business. If you can save that 2MB per user per cache life, you pay that much less on the internet bill for your hosting.

Every byte sent uses up some of your limited bandwidth while it is being sent. If your site is 10KB and you rely on 2MB of javascript libraries and fonts, offloading that 2MB is quite a significant reduction is resource usage.

These above two views seem vastly more important than terminal laziness, up-time management, etc.
When air pollution in cities is discussed, many people immediately assume traffic. But for particulates, traffic is associated with just about 1/4 of total amount, while about 1/2 is associated with local solid fuel heating (both coal and wood).
Couldn't this particular trick be done purely server-side?
The people who build FB's ads platform have their performance judged by metrics like revenue, eCPM, and internal relevance scores.

Building capabilities to add arbitrary human-defined rules into those optimization functions only makes their jobs more difficult and is a drag on hitting team targets. I'm curious why you think they're incentivized to do so.
Facebook Open-Sources Multilingual Speech Recognition Deep-Learning Model
https://archive.is/aepC5
The article mentions dust in the atmosphere being a problem.
>Can you elaborate on the tracking part? I am a Plex user but unaware of this.

I got rid of plex once they made everything (including metadata lookups) go through their system. And you cannot run plex without it calling home and requiring an account.
In the last few images, the passing of Phobos in front of the Sun looks like an eye.
It's the other edge of the monorepo/standardized tooling sword. You get nearly unlimited access to the work of people who have come before you, but separating your work from the internal commons is no small task.

I suspect most Google projects would be non-trivial to open source (even without legal concerns). Building software with Google's internal tools is very different than what's popular in the open source world.

It cuts both ways: Many open source tools would be difficult to use at Google, because they presume open source tools and package managers that don't have equivalents in the Google codebase.
Ok, we'll change to that from https://www.ft.com/content/8e69d4da-00d2-4ada-96f0-b5dc5c7ca.... Thanks!
That's what I get for not reading the datasheet more carefully, I guess. Thanks, I'll switch to that, I have a bunch of bare modules.
Unless you’re clearing cache, local storage, and HSTS, They can still track you. We haven’t got to the other things that can keep state that don’t reside in the browser. Not to mention fingerprinting the device itself, I’ve seen fingerprinting minute differences in CPU since they aren’t all identical.
I see these waves of ads for particular categories often on Facebook. Low-alcohol or non-alcoholic cocktails are still going strong, though they've been eclipsed by ads for a very particular kind of faux-athletic shoe (pretty sure they're exactly the same shoe even though it's a dozen companies). I have to admit, after a while I sometimes do get a bit curious. The frequency itself makes some part of my brain think this must be A Thing, and that I must pursue The Thing, even though my rational brain knows it's entirely otherwise. It's a powerful effect. Whether intentionally or not, I think Facebook's ad-selection algorithms create these "category waves" even across multiple products and vendors because they do work. Therefore it's not surprising that such a wave related to the most controllable of minds is the biggest of all.
Planned obsolescence is a tricky term and has many faces (see e.g. a classification at [0]). A good and widespread example of overt, in-your-face planned obsolescence (surprisingly not mentioned in the article I linked) is "fast fashion", where nobody even tries to hide that clothing is designed to deteriorate quickly, to accommodate a season-long replacement cycle.

I think race to the bottom deserves to be its own type of "planned obsolescence" (again, not mentioned in the Wikipedia classification). While in a highly competitive market, the design process may boil down to "do the same as competitor X, but slightly cheaper" instead of explicitly setting the durability target low, the end result is the same - products that have no business existing enter the market, live very briefly, and forever enter the waste stream. It's a systemic problem, and it's planned in the sense that if you enter such a market, you've already decided to create short-lived trash.

--

[0] - https://en.wikipedia.org/wiki/Planned_obsolescence#Types